Gracefully Prevent Keys from Ever Being Used for the Wrong Header-Specified Algorithm #352

paragonie-security · 2021-08-04T09:43:24Z

Proposed Fix for #351

This aims to provide backwards compatibility by guessing the algorithm for a key based on the key's contents, but it will likely fail in corner cases.

If this is merged, users SHOULD be explicit about the algorithms they're using.

i.e. Instead of $keyAsString, pass in (new JWTKey($keyAsString, 'ES384'))

This aims to provide backwards compatibility by guessing the algorithm for a key based on the key's contents, but it will likely fail in corner cases. If this is merged, users **SHOULD** be explicit about the algorithms they're using. i.e. Instead of $keyAsString, pass in (new JWTKey($keyAsString, 'ES384'))

pwolanin · 2021-08-16T14:28:00Z

src/JWT.php

-        if (\is_array($key) || $key instanceof \ArrayAccess) {
+        /** @var Keyring|JWTKey $key */
+        $key = self::getKeyType($key, $allowed_algs);
+        if ($key instanceof Keyring) {


Why hard-code this class? It means I can't implement my own key database or just use an array of key objects. There is verification below that the key type is as expected.

Feel free to swap it out for an interface in your own implementation. This is just a proof-of-concept fix.

pwolanin · 2021-08-16T14:28:36Z

src/JWT.php

+            // See issue #351
+            throw new UnexpectedValueException('Incorrect key for this algorithm');
+        }
+        if (!static::verify("$headb64.$bodyb64", $sig, $key->getKeyMaterial(), $header->alg)) {


For better BC, just cast the key to string?

pwolanin · 2021-08-16T14:30:54Z

src/JWT.php

@@ -121,9 +126,16 @@ public static function decode($jwt, $key, array $allowed_algs = array())
                throw new UnexpectedValueException('"kid" empty, unable to lookup correct key');
            }
        }
+        if (!($key instanceof JWTKey)) {


For BC, why not construct the object here if the key is a string and guess the alg?

pwolanin · 2021-08-16T14:32:14Z

src/Keys/JWTKey.php

+     */
+    public function isValidForAlg($headerAlg)
+    {
+        return JWT::constantTimeEquals($this->alg, $headerAlg);


Why do you need const time comparison here? The alg is generally known or picked from a short list.

Consistency.

src/Keys/JWTKey.php

pwolanin · 2021-08-16T14:39:57Z

src/JWT.php


        // Check the signature
-        if (!static::verify("$headb64.$bodyb64", $sig, $key, $header->alg)) {
+        if (!$key->isValidForAlg($header->alg)) {


It seems like the alg guessing code should allow multiple? e.g. if it's an RSA key type all the signature lengths should pass here. The way it looks now, if RS512 and RS256 are supported by the endpoint, and a bare string key is passed in, a request with a header alg RS256 fails?

We don't feel particularly strongly about the safety and correctness of this guessing code. We'd feel much safer if a major version bump with a small risk of BC breaks was elected instead.

bshaffer

The changes here causes our tests to fail in 6 different places. I think this is a significant enough number to indicate to me at least that these changes represent too large of a BC break for the current version.

I am in support of creating a major version release with these changes, and requiring the keys to represent a Key or KeyRing object instead of allowing a key without an algorithm. I think this is the better approach, rather than break a significant number of users with this change.

Thanks so much for your work on this!

bshaffer · 2021-11-03T16:54:52Z

src/Keys/JWTKey.php

+    public static function guessAlgFromKeyMaterial($keyMaterial, array $candidates = array())
+    {
+        $length = JWT::safeStrlen($keyMaterial);
+        if ($length >= 720) {


For the tests you've provided, this does not pass with the generated RSA public key. The public key is of length 272. Is this a bug or is the guessing expected to be that brittle?

it could be because the tests are generating a key with only 1024 bytes. When I change this to 4096, the tests for RSA pass.

This was a canned guess at key size. 1024-bit RSA is a bit dodgy; 3072-bit and higher is recommended.

The other thing we could do is parse the base64-encoded string and inspect the ASN.1 header. That's probably a bit more reliable. I'll send a superseding pull request that does that instead.

bshaffer · 2021-11-03T17:00:15Z

src/Keys/JWTKey.php

+                }
+                return 'RS256';
+            }
+        } elseif ($length >= 220) {


Same issue here - the EC key generates with length 215, and so the tests for EC keys fail.

What curve are you using?

The test you provided!

bshaffer · 2021-11-03T17:07:35Z

tests/Keys/JWTKeyTest.php

+        $this->assertSame(
+            'HS384',
+            JWTKey::guessAlgFromKeyMaterial($misc, array('HS512'))
+        );


This test also fails, I'm not sure why

This looks like a pasto. Line 48 should be HS512 when compared with the lines below.

bshaffer · 2021-11-03T21:21:13Z

@paragonie-security I've decided to avoid trying to guess the algorithm, and instead make providing an algorithm supported in v5 and required in v6. Please see my PRs #365 (v5) and #364 (v6).

I think providing a quick and easy way for users to upgrade is preferable to the almost certain breakage of existing implementations if we try detecting the algorithm. Please let me know what you think, and I would love a review of the above PRs as well, if it isn't too much trouble!!

paragonie-security · 2021-11-03T21:58:20Z

Yes. We agree that algorithm guessing is dangerous. That's why we eschewed it in the wrapper library that addresses the issue.

This PR was always intended as a proof of concept for a fix, in case you were at a loss for how to tackle the changes. We're happy to review your PRs in favor of this one.

bshaffer · 2021-11-03T22:17:54Z

@paragonie-security Thank you so much for all of your help with this! I will await your review of my other PRs before merging.

googlebot added the cla: yes label Aug 4, 2021

paragonie-security force-pushed the issue-351 branch 3 times, most recently from 8b658c3 to e3fb77d Compare August 4, 2021 09:44

paragonie-security force-pushed the issue-351 branch from e3fb77d to 31a7c16 Compare August 4, 2021 09:49

Add unit tests for current behavior

e08160a

paragonie-security mentioned this pull request Aug 6, 2021

Possibility of Reintroducing HS256/RSA256 Type Confusion (CVE-2021-46743) #351

Closed

avolkovi requested review from malcolmdeck and hiranya911 August 12, 2021 16:53

pwolanin suggested changes Aug 16, 2021

View reviewed changes

hiranya911 requested a review from bshaffer August 16, 2021 17:46

bshaffer reviewed Nov 3, 2021

View reviewed changes

This was referenced Nov 3, 2021

feat!: Require Key object when decoding JWT objects #364

Closed

feat: add key object v5 #365

Merged

paragonie-security closed this Nov 3, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Gracefully Prevent Keys from Ever Being Used for the Wrong Header-Specified Algorithm #352

Gracefully Prevent Keys from Ever Being Used for the Wrong Header-Specified Algorithm #352

paragonie-security commented Aug 4, 2021 •

edited

pwolanin Aug 16, 2021

paragonie-security Sep 8, 2021

pwolanin Aug 16, 2021

pwolanin Aug 16, 2021

pwolanin Aug 16, 2021

paragonie-security Sep 8, 2021

pwolanin Aug 16, 2021

paragonie-security Sep 8, 2021

bshaffer left a comment

bshaffer Nov 3, 2021

paragonie-security Nov 3, 2021

paragonie-security Nov 3, 2021

bshaffer Nov 3, 2021

paragonie-security Nov 3, 2021

bshaffer Nov 3, 2021

bshaffer Nov 3, 2021

paragonie-security Nov 3, 2021

bshaffer commented Nov 3, 2021

paragonie-security commented Nov 3, 2021

bshaffer commented Nov 3, 2021

Gracefully Prevent Keys from Ever Being Used for the Wrong Header-Specified Algorithm #352

Gracefully Prevent Keys from Ever Being Used for the Wrong Header-Specified Algorithm #352

Conversation

paragonie-security commented Aug 4, 2021 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bshaffer left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bshaffer commented Nov 3, 2021

paragonie-security commented Nov 3, 2021

bshaffer commented Nov 3, 2021

paragonie-security commented Aug 4, 2021 •

edited